5.1 Constitutional Court decisions
Decision 3/2023 (IV. 17) AB concerning the establishment of unconstitution- ality caused by an omission related to the accessibility of bank secrets that qualify as data of public interest or data accessible on public interest grounds. [NAIH/5942/2022 – providing an opinion]
The petitioner initiated a lawsuit for the issue of data of public interest against Eximbank. The courts sustained the petition and ordered the bank to issue the data. The court of second instance upheld the decision. The Curia repealed the final judgment, changed the verdict of the court of first instance and rejected the petition. According to the position of the petitioner, the bank secret is not an un- conditional impediment to the freedom of information, instead it is a restriction as a trade secret, based on a test regulated by law. The Curia was wrong in ap- plying it as an absolute impediment, whereby it violated the enforcement of the freedom of information. In the course of its proceedings, the Constitutional Court contacted the Nemzeti Adatvédelmi és Információszabadság Hatóság (hereinaf- ter: NAIH). The Authority deemed that “in the case under investigation, based on the identity of the controller (an organ performing public duties) and the activities carried out by it (management of public assets, public funds with a view to the im- plementation of governmental cooperation and economic policy), the provisions of the Privacy Act concerning the issue of data of public interest should apply”. At the same time, “it would create a clear-cut legal situation, if the reference to obli- gations concerning data of public interest – and hence the legal exemption from bank secrets – were to appear among the provisions of the Exim Act”. In its deci- sion, the Constitutional Court established that in the present regulatory environ- ment the bank secret excludes the data of all the clients of Eximbank (even if they are legal entities) without regard to the fundamental right of the freedom of infor- mation in a manner excluding consideration from the public, in spite of the fact that in the context of tied-aid loans, the bank performs public duties as the organ implementing government decisions, in the course of which it manages public funds, which fact is known in advance to the beneficiaries of the loans. Within this category, the constitutional interest in the accessibility of data as a main rule takes precedence over the interests in protecting secrets. However, the accessi- bility of dual nature data, held by Eximbank, i.e. data of public interest(or acces- sible on public interest grounds) covered within the notion of bank secret is not at all ensured in the current regulatory environment: the restriction of accessibil-
ity is total, not tailored to the unconditionally necessary and proportionate extent and there is no possibility for considering whether the data may be issued. The Constitutional Court therefore established that the legislator created a breach of the Fundamental Law by omission, failing to enact guarantee rules enabling the enforcement of the freedom of information with regard to the accessibility of bank secrets qualifying as data of public interest or data accessible on public in- terest grounds held by Eximbank that performs public duties and manages public funds, so the Constitutional Court called upon the Parliament to meet its legisla- tive duties related to this.
Order 3525/2023. (XII. 14.) on the rejection of a constitutional complaint: until the commencement of the performance of the public duties, the request to access data is premature [antecedent: Budapest Court of Appeal Pf. 20.290/2023/6.]
Based on Section 53/A(1) of Act CLXXXV of 2012 on Waste, the contract con- cluded with the state entered into force on 1 July 2023 with the provision that the concession company will be entitled to exercise the concession only “if it obtains the necessary permits and concludes the contracts providing for capacity” by 31 December 2022 at the latest. On 31 January 2023, the petitioner submitted a re- quest for data of public interest to the concession-holder, in which he requested the permit and the one or more contracts providing capacity. The Constitutional Court established that it does not follow from the final court decision approv- ing the rejection of the request as the basis that data related to the preparatory activity in the context of the performance of public duties are not data of pub- lic interest under any circumstance, but that the request to access the data is in fact premature until the commencement of the performance of the public duty. Until the entry into force of the concession contract, essentially a contingent le- gal situation obtains, or if the concession contract does not enter into force for any reason, with regard to the concession-holder (and the concession company founded by it) cannot be said to be performing public duties and so there are no data of public interest in view of Section 3(5) of the Privacy Act. Based on all this, not even a doubt concerning unconstitutionality influencing the court’s decision in merit arose, hence the Constitutional Court rejected the complaint. [See also Budapest Court of Appeal Pf. 20.540/2023/4]
Decision 3483/2023 (XI.7.) AB Accessibility of the benefits of senior employees of the National Office for the Judiciary (OBH)
In his request for the issue of data of public interest, the petitioner requested the sending of data concerning certain benefits paid to the leaders of the National
Office for the Judiciary (OBH) in a breakdown by name and the year of payment. In its answer, OBH refused to grant the request for data because, in their view, these do not qualify as data accessible on public interest grounds. In its deci- sion, the Constitutional Court established that OBH as an organisation manag- ing public funds is under an obligation to provide information on the total amount of benefits paid to its employees and their background. However, it is not an un- necessary and disproportionate restriction of the right to access data of public interest when the controller refuses the request for data extending to the ben- efits of every employee in a managerial position. The final court judgment found a fair balance between the accessibility of data and the protection of personal data, hence it did not result in a violation of the petitioner’s right set forth in the Fundamental Law. Because of this, the Constitutional Court rejected the consti- tutional complaint.
Constitutional Court Decision 3359/2023 (VII. 5.) AB
The data generated in a contractual relationship between an association and third persons do not qualify as data accessible on public interest grounds, even if they concern the use of funds affecting the central budget.
The association received a state grant of 150 million forints to develop a visitor’s centre under one of the programmes of the agency for tourism, which amount was to be used to purchase real property, to obtain the venues of the planned investment, to prepare a feasibility study, to implement the required zoning clas- sification, to prepare constructions plans and to launch a public procurement procedure. After this, the petitioner submitted a request for the issue of data of public interest to the association and requested the issue of the purchase and sale contracts concerning the real property bought by the association. The as- sociation did not respond to and did not comply with the request for data of pub- lic interest.
The regional court deemed that in the absence of the relevant public service contract and a budgetary grant to finance the task, it cannot be said that the association would have been under an obligation to perform the public duty in- dicated. The regional court also established that the association supports the performance of the public duties indicated through its activities for the public good, hence the respondent cannot be regarded as an organ performing public duties. The contracts of purchase and sale concluded by the respondent can- not be regarded as data of public interest merely because they were concluded by the respondent. The association did not conclude the contracts requested to be issued by the petitioner with a subsystem of general government, but it pur-
chased real property from a third person out of the state grant paid, based on a grant contract concluded with a person belonging to the subsystem of gen- eral government. The data generated in a contractual relationship established between an association and third persons do not qualify as data accessible on public interest grounds, even if they are related to the use of funds affecting the central budget.
The Constitutional Court deemed that the court decision contested by the pe- titioner does not suffer from deficiencies that would raise doubts of unconsti- tutionality influencing the judicial decision in merit, or any fundamental issue of constitutional significance.
5.2 Court decisions
5.3 Court decisions concerning the freedom of information in 2023, in which statements of NAIH were referred to
Kúria Pfv. 20.087/2023/6., Issue of public interest, (Reference to statement NAIH/2017/2408/2/V)
The respondent’s responsibilities include the development of the documenta- tion of the review of Hungary’s National Energy and Climate Plan (NEKT) due in 2023. An independent part of this is the so-called final environmental assess- ment (SKV). In a request for data of public interest, the petitioner requested the respondent to issue data of public interest indicated in altogether four points.
The respondent informed the petitioner that the data requested to be accessed support decision-making, hence it is not in a position to send them. In their an- swer, they stated that the EU regulation for setting up the framework for consul- tation does not provide for a time limit; the draft of the first update of NEKT has to be produced by 30 June 2023; the submission would be preceded by social consultation; the decision on its process would be made later. The petitioner re- quested that the respondent be ordered to issue the environmental assessment produced for Hungary’s National Energy and Climate Plan.
The court of second instance, in the justification of its judgment upholding that of the court of first instance, sustained the petition referred to in statement NAIH/2017/2408/2/V of the Hungarian National Authority for Data Protection and the Freedom of information, in which the Authority declared that examining accessibility of environmental information as data of public interest in the regu- latory system of the Privacy Act leads to the establishment that the provisions re-
stricting accessibility to data supporting decision-making – Section 27(5)-(6) of the Privacy Act – cannot be applied to environmental information because their nature supporting decision-making is based not only on formal criteria, but also on those of content.
According to the judgment of the Curia, the respondent’s (controller) request for review is ungrounded, no specific justification for the reasons for restricting ac- cessibility was given in the specific case, the respondent referred to the fact that NEKT had to be reviewed based on EU regulations only in general and this re- quires the processing and reassessment of the SKV asked to be issued. The courts taking action correctly referred to the fact that legal regulations require the publication of the SKV. According to the Curia’s statement of principle, if a separate legal regulation requires the publication of a document containing data of public interest, the controller may not refuse access to the document by refer- ring to the data as supporting decision-making. General reference to the nature of the data as supporting decision-making without any specificities is insufficient for denying the issue of the data.
Kúria Pfv. 20.112/2023/5.– Issue of data of public interest, data of government meetings
On 6 January 2022, the petitioner submitted a request for data of public interest to the respondent (Prime Minister’s Government Office) requesting the electron- ic transmission of the dates of government meetings held in October 2009, the copies of the summaries of the meetings and the annexes thereto.
On 22 January 2022, the respondent extended the period open for granting the data request, then in its answer sent on 21 February 2022 refused compliance with the request based on Part IV of the justification to the Constitutional Court’s Decision 32/2006. (VII. 13.) AB.
In its earlier precedent-setting decision, Curia stated as a matter of principle that the obligation to provide data of public interest is independent of the type of organisation concerned, its ownership relations, its activities; the obligation to make data of public interest accessible is established merely by the fact of pos- sessing the data of public interest (Kúria Pfv.IV.20.911/2018/4.). In line with this, the Authority’s statement of 28 February 2022 declared that in general it is not an impediment to issuing the data that the data themselves do not relate to the operation of the organ performing the public duty in itself, or were generated in the context of its own operation, merely the fact that the data were in the pos- session of the controller (which was not disputed in the given case) in itself lays
the ground for the obligation to issue the data. Nevertheless, the courts taking actions did not violate any legal regulation when they did not order the petition- er to furnish additional evidence with regard to the nature of the requested data as data of public interest, or the activities of the respondent controller. Overall, it can be established that the requested data qualify as data of public interest, ir- respective of whether they apply directly to the activities of the respondents or were generated in relation to its activities.
Budapest Court of Appeal Pf. 20.236/2023/5. Issue of data of public interest – Accessibility of data of government meetings
The court of first instance correctly stated in its decision that the data requested to be issued in the lawsuit qualified as data of public interest not on the basis of Section 7(3) of the Administration by Government Act but under the provisions of the Privacy Act.[...] The Constitutional Court in its decision (32/2016 (VII. 13.) AB) stated on the one hand that the classification of certain data of government meetings cannot be regarded as anti-constitutional and on the other hand that pursuant to Section 7(1) of the Administration by Government Act, the meetings of the government are not public.[...] It follows that the data requested by the peti- tioner qualify as data of public interest, the capacity of the respondent as control- ler can be established and, furthermore, the data were not classified by a person or organisation entitled thereto in a procedure specified by legal regulations, they were not classified data, hence the data have to be issued upon request.
Budapest Court of Appeal Pf. 20.376/2023/4., Issue of data of public interest, Hungarian Association of Judicial Officers (MBVK) (case of the same subject matter: NAIH-2825-8/2022.)
By a request for data of public interest, the petitioner requested the respondent, the Hungarian Association of Judicial Officers (MBVK) to issue the contracts concluded with six legal entities in relation to the performance of its public duties, and any eventual contract amendments and annexes. The respondent denied the petitioner’s request stating that in its view the requested data qualified as per- sonal data as the data of natural persons can also be found in the contracts and that the contracts also contain trade secrets. It also stated that the entirety of the contracts as documents are not within the notion of data of public interest or data accessible on public interest grounds, hence the requested contracts cannot be issued even under a request for data of public interest.
In its judgment, the court of first instance ordered the respondent to issue the re- quested documents to the petitioner within 15 days obliterating the personal data in the documents. The court’s position was that pursuant to Sections 34/A(1), 250(1) and (2) of Act LIII of 1994 on Judicial Enforcement, the respondent doubt- lessly performs public duties when discharging its duties related to enforcement. In view of this, the data in its possession concerning its activities and financial management are data of public interest, which the respondent has to make ac- cessible to anyone. With regard to the personal data included in the contracts, the courts declared that even if the contracts requested to be issued have such content that, however, does not provide grounds for denying the issue of the en- tire document. The court also explained that the respondent must grant the re- quest to issue the data in such cases, while blocking the personal data.
The court declared that the legal regulation does not contain any restriction as to what extent of the data content of contracts subject to the disclosure of data can be requested; these contracts meet the notion of data of public interest and the petitioner lawfully requested their issue, in view of which the denial by the re- spondent was qualified as unlawful.
In its appeal, the respondent expressly acknowledged that it performed public duties. With regard to the accessibility of data of public interest, Section 26(1) and Section 3(5) of the Privacy Act are of decisive significance; this regulation does not specify the fact of managing public funds as a condition of performing public duties and indirectly as a criterion of having access to data of public inter- est. Based on the definition of the notion of data of public interest with regard to the right to access data of public interest, the following are of outstanding signifi- cance: - the requested information should be processed by the organ perform- ing public duties; - the data apply to the activities of the organ performing public duties, or be generated in relation to the performance of its public duties; - the data do not qualify as personal data. Based on Section 1 of the Privacy Act, the notion of personal data as set forth in Section 3(2) of the Privacy Act can only be applied to natural persons. Judicial practice has been consistent in that if in a lawsuit for access to data of public interest the respondent refers to the existence of a trade secret only in general, by invoking a legal regulation, this does not lay the grounds for the restriction of accessibility. The link between a trade secret and the blocking of personal data in the documents may only relate to the per- sonal data of natural persons, and therefore no inference can be drawn from this to the existence of a trade secret or the disproportionate injury by the disclosure.
Budapest Court of Appeal, Pf. 20.555/2023/6. (NAIH-873/2022, NAIH-977/2023) – Production of new data, formal reference
The respondent (Central Administration of National Pension Insurance – ONYF) was unable to prove beyond any doubt that they rejected the data request for well-grounded reasons based on Section 31(1) of the Privacy Act and that grant- ing the request would have qualified as the production of new data based on the criteria of Constitutional Court Decision 13/2019. (IV. 8.) AB. So the infor- mation requested by the petitioner qualified as data of public interest according to Section 3(5) of the Privacy Act processed by the respondent and the court of first instance ordered the respondent with good grounds to render them ac- cessible based on Section 26(1) and 28.(1) of the Privacy Act. In his request for data, the petitioner requested the detailed data of allowances disbursed by the ONYF for the years 2017-2022 in a breakdown. The respondent did not dispute that the requested information can be produced in its answer to the Authority, it even referred to the data processing steps required; the facts of the case did not have to be supplemented in this regard. The burden of proof with respect to the lawfulness and justification of the denial lay with the controller, i.e. the re- spondent. As a justification for denial, the respondent stated that it had to pro- duce new data to comply with the request and it was not under an obligation to produce the data. Consequently, based on Section 31(2) of the Privacy Act, it had to prove that generating the requested information was such a complex task which, in view of the justification of the Constitutional Court Decision, qualifies as the generation of new data, hence it does not process the requested data of public interest. It cannot be assumed that the required IT and legal knowledge was not available to the respondent that processed large quantities of personal and other data. The respondent did not state either in the lawsuit or in the pro- cedure before the Authority that providing the information would jeopardise its operation or eventually involve a disproportionate volume of work and would be abusive. Hence, it was not necessary to consider whether the right to access data of public interest could be restrictive in the interest of protecting a consti- tutional interest in accordance with the justification of the Constitutional Court Decision (paragraph [56]). Pursuant to the Constitutional Court Decision (para- graph [58]), the fact that the requested information of public interest is not avail- able elsewhere (data monopoly) has to be taken into account. In its procedure, the Authority attempted to clarify the accurate operations, data processing steps; however, in its answer the respondent did not specifically present the processing steps leading from the personal data to the requested information, it merely re- ferred to general mathematical and IT operations, on the basis of which, in view of the electronic processing of the data, it was not possible to make any conclu-
sions concerning the justification and the grounds for the denial. Nor could any conclusion be drawn as to what extent the described mathematical and IT oper- ations qualify as complex. In this respect, it must be taken into account that the respondent has processed the elementary (personal) data electronically, which was not disputed. So, the same processing operations which may qualify as complex on paper and involve a substantial workload can be carried out quickly and simply electronically with or without algorithms and functions for a person with IT qualifications, depending on the circumstances and the IT possibilities of searching and anonymisation. The information obtained in this way can be fil- tered, sorted and summarised in tables using the same operations. The neces- sary data of the tables can be summed by simply adding up the lines of the tables using IT methods (simple mathematical operations). In this context, it should be borne in mind that a request for the collection of the recorded data, their sort- ing according to specific criteria and arranging them in tables cannot fundamen- tally be denied according to the justification of the Constitutional Court Decision (paragraph [55]) Depending on the circumstances, it is possible that in posses- sion of a methodology known, based on an earlier request for data, the data re- quested by the petitioner should be perceived according to the justification of the Constitutional Court Decision (paragraph [49]) that the requested informa- tion “is ready and available”. The respondent failed to present any other spe- cific fact enabling the assessment of the processing steps. In its answers to the questions posed in the Authority’s procedure, it failed to make any statement of merit concerning the time and labour required for the operations, and the statis- tics used to process the data of pension payments. Instead, the respondent un- derlined both in the procedure before the Authority and the court its position that the required processing operations described go beyond simple mathematical or IT operations, however, this statement could not be checked in the absence of the presentation of the specific data generation steps. Without the possibility of checking the content of the reasons for denial, the denial of a request to ac- cess data of public interest with reference to the generation of new data proved to be a mere formal reference, which in the practice of the Constitutional Court is an impermissible restriction of the freedom of information, hence it is not lawful. In this context, the Budapest Court of Appeal underlines that under the justifica- tion of the Constitutional Court Decision {paragraph [61]}, it has to be examined with the greatest of care whether the data request is indeed for the generation of new data, which qualitatively differ from the processed data as denial of access to data of public interest may ultimately impede informed participation in debates on matters of public interest.
5.3.1 Further court decisions concerning access to data
Kúria Pfv. 20.041/2023/6. Issue of data of public interest: data to support deci- sion-making
According to the arguments of the respondent (Prime Minister’s Office) in the re- view proceedings, the procedure of furnishing evidence did not violate the law, but the court of second instance failed to enforce the constitutional criteria for ex- cluding access to the requested data with sufficient weight, which was an issue of substantive law affecting the legal basis of the petition. [...] In these cases, the point of departure is that preparation for decision-making by civil servants should be carried out freely, informally and free of the influence of the public as a safe- guard for the quality and efficiency of the work by civil servants [Constitutional Court Decision {21/2013. (VII. 19.), Justification [43]. [...] Once the decision is made, the principle of accessibility is again applicable to the data as a main rule, and – within the period specified in paragraph (5) – the data request may be de- nied only if the data support additional future decision-making or access to the data would jeopardise a lawful operation or the performance of the functions and responsibilities of organs performing public duties free of undue external influ- ence, thus, in particular, the free expression of the views of those generating the data in support of decision-making [Constitutional Court Decision {3190/2019. (VII. 16.) Justification [39]) [...] According to the four-step test, the data support- ing decision-making must be related to a specific decision-making procedure; the entire document irrespective of its content cannot be qualified as data sup- porting decision-making; instead of the document principle, the data principle has to be applied; the controller may not invoke so-called “criteria of conveni- ence”; the decision rejecting the data request must be justified in terms of con- tent and the court taking action must equally examine the grounds for denying the provision of the data and the deficiencies of its content based on the docu- ment constituting the subject matter of the data request.
Kúria Pfv. 20.509/2023/4. – Issue of data of public interest – data supporting fu- ture decision-making as the reason for refusal
The Curia had to come to a decision whether there is a reason to restrict acces- sibility based on Section 27(6) of the Privacy Act. [...] According to Section 27(6) of the Privacy Act, within the time limit of 10 years referred to in paragraph (5) – a request for access to data used for supporting decision-making may be refused after the decision is adopted, if
- the data supports also future decision-making, or
- access to it would jeopardise the lawful functioning of the organ perform- ing public duties, or the performance of its functions and powers with- out undue external influence, such in particular the free expression of its views generating the data during the preparatory stage of decision-mak- [...]
As the Curia also accessed the content of the report, it upheld the position tak- en by the court of second instance that the report fundamentally contained facts and data, whose issue would not in any way materially affect the lawful operation of the respondent, which has a professional staff, or the exercise of its functions and powers without undue external influence .[...] In this context, the Curia em- phasised that the accessibility of data of public interest has a constitutional role: to render the operation of the state and the use of public funds transparent and the report is expressly linked to this.
Kúria Pfv. 20.234/2023/3. Issue of data of public interest – threat to IT security
According to the interpretation of the law by the Curia, the following provisions of the Information Security Act, ensuring protection of the electronic system, facili- tate the attainment of this objective of the law: Section 1(1)(8) of the Information Security Act defines the notion of secrecy (the feature of an electronic informa- tion system that the data and information stored therein can be accessed, used or disposed of only by people authorised thereto and only according to their lev- el of authorisation).[...] The above provisions of the Information Security Act as the law referred to in Section 27(2)(c) of the Privacy Act clearly state who is au- thorised to access data stored in a closed system depending on security clas- sification and under what conditions and that the principle of secrecy must be implemented through the entire life cycle with a view to the protection of the na- tional data assets.[...]
According to the Curia’s interpretation based on Article 28 of the Fundamental Law, bearing in mind the objectives indicated in the Recital to the Information Security Act, an interpretation of the provisions ensuring the protection of the electronic information system containing the register of personal data and resi- dential addresses at the highest level, which would render protection contingent on which element of the system architecture it applies to, goes against com- mon sense.[...] Although the laws restricting the freedom of information should be interpreted strictly, in the given case under a different interpretation, the full protection of the electronic system containing the register of personal data and
residential addresses cannot be guaranteed, this restriction is expressly permit- ted by Section 27(2)(c) of the Privacy Act for the prosecution or prevention of criminal acts and it means a legitimate restriction of the accessibility of certain data of public interest.
Budapest Court of Appeal Pf. 20.369/2023/3. Issue of data of public interest – data of hospital infections – National Centre for Public Health and Pharmacy
Exemption from the obligation to make data public cannot be based on the argu- ment that the disclosure of the data – without knowledge and assessment of the additional information necessary for the analysis of the data – leads to incorrect interpretation or conclusions.
Reference to the fact that the requested data were unavailable was not made in the course of the lawsuit, only in the appeal based on Section 14(1) and (2) of Decree 20/2009. (VI. 18.) EüM on the prevention of infections related to health- care and the professional minimum criteria and supervision of these activities. [...] Based on all this, the obligation of electronic publication does not influence the requirement of meeting the petitioner’s request for data in view of the fact that not even the respondent argued in the lawsuit that from the links indicated in its answer sent to the petitioner in the course of the preliminary procedure, the summary reports of the infection data of the given years were accessible.[...] The Budapest Court of Appeal agreed with the position of the court of first instance that the reference that the publication of the number of infections in individual healthcare institutions and their eventual propagation could be misleading, and that there could be a risk that the misinterpretation of information on hospital in- fections would result in decreased confidence in certain institutions could not be used by the respondent for exemption from the obligation to issue the data. [...] The Curia (in its judgement Pfv. 21.081/2018/5 stated that although the court may not examine the purpose of lawful processing, it attached importance to stating in view of the specific nature of the data that the accessibility of data of public interest is closely related to the right to freely express opinions, which right should be exercised with responsibility.
Budapest Court of Appeal Pf. 20.385/2023/4. – Meeting a request for data of public interest by inspection
The respondent did not dispute that it was an organ performing public duties or that the data wished to be accessed by the petitioner where data of public inter-
est, so it had to be examined whether the possibility of inspection offered by the respondent qualifies as meeting the petitioner’s request to access data of pub- lic interest.
The court of second instance emphasized that according to Section 30(2) of the Privacy Act, data requests shall be complied with in a comprehensible manner and if the organ performing public duties that processes the data in question is able to bring it about without disproportionate difficulties in the form and manner requested by the requesting party.
During the litigation, it was not disputed that complying with the request in the manner indicated by the petitioner would not have given rise to disproportionate difficulties for the respondent (an organisation performing public duties), hence it should have met the data request in the manner indicated.
